1. Technical Field
The present invention relates generally to client-server computing over the Internet and more particularly to a lightweight authentication service and method to validate a given interaction with a target server.
2. Description of the Related Art
The World Wide Web is the Internet's multimedia information retrieval system. In the Web environment, client machines effect transactions to Web servers using the Hypertext Transfer Protocol (HTTP), which is a known application protocol providing users access to files (e.g., text, graphics, images, sound, video, etc.) using a standard page description language known as Hypertext Markup Language (HTML). HTML provides basic document formatting and allows the developer to specify "links" to other servers and files. In the Internet paradigm, a network path to a server is identified by a so-called Uniform Resource Locator (URL) having a special syntax for defining a network connection. Use of an HTML-compatible browser (e.g., Netscape Navigator or Microsoft Internet Explorer) at a client machine involves specification of a link via the URL.
A given collection of files located at a Web server is sometimes referred to as a Web site. Site operators often desire to monitor the quality-of-service they provide to users, for example, to address and rectify service problems. Moreover, it is also known in the art to implement Web site diagnostic services whereby a given target server is "scanned" or analyzed to evaluate some given metric. Thus, for example, it may be desired to scan a given server for security vulnerability. A security scan thus might evaluate the server's configuration and identify the various software programs (and their version numbers) supported on the platform. If the security of the server is vulnerable based on some given exposure level criteria, an appropriate report may be generated so that corrective action (e.g., upgrade to a newer software version for a given program) may be taken.
While security scans may have a valid purpose, they may also be used maliciously. A scan may be used to collect information (e.g., software versions) about the server that might later be helpful in allowing an interloper to bypass system safeguards. Thus, a scan may be used to find a deficiency in the server's security that may be later exploited in a full scale attack directed at the weakness. More likely, a given security scan may be designed to simply make the server so busy that it cannot otherwise service normal requests. Such "denial of service" attacks succeed by diminishing the server's ability to perform its required processing.
A site operator may also desire to scan its server for reasons of evaluating performance, capacity or other operations. Such a scan may identify any number or type of metric, such as broken links, HTML syntax errors, aggregate file size, number of files, response times, browser incompatibility, and the like.
Regardless of the scan's purpose, providers (whether the site operator or some third party) have a significant interest in minimizing its legal exposure for any damage or loss resulting from the scan. Thus, for example, a site operator would never knowingly allow a large scale security scan to take place during the time of day when the site is expected to receive its heaviest traffic. Were such a denial of service attack to occur, the operator might face legal liability due to attendant loss.
It would be highly desirable to provide new methods and systems that would promote the widespread use of security and performance scans while at the same time reduce the likelihood that one performing such a scan would be held legally responsible for some act or omission during its occurrence.
The present invention addresses this need.